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This document is an excerpt from Special Source Operations Weekly, an internal National Security Agency publication dated 14
March 2013. It describes a common NSA problem of collecting too much information — and how the agency is attempting to control

it.
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MUSCULAR

- Minor circuit move. not collection suite move
(so-201300762)

- XKS FP updates across TU systems I
NArchive throttle update
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Spea ker's Notes

From Feb 28 2013 Pr()powd/rnmunenl latest DONolunw rr-duttron Narrhwe

81 {JF' Requested S? (onturrence at S? “C on 2'5 r‘r-b wrth partial throttling of tontent from Yahoo, Narthwr- r-marl traffac whxh
contarns data older than 6 months from MUSCUlhR. Numerous 52 analysts have complarned of Its PIISTPHEE, and the relatwely
tmall Intelligence value rt coma-m does not Justrfy the sheer volume of (oflethon at MUSCULAR l Udth of the total darly collect)

Background Srnce Jul-Ir of 2012, Yahoo has been transferrrng entrre email accounts usmg the Narchrve data format [a proprretary
format for emu-ch NBA had to develop custom demultrplexers] To date, we are unsure why these accounts are being transferred --
movement of mdrwduals. barkup of data from overseas sewers to US servers. or some other reason there Is no war,- currentlyr to
predlct If an amount WI" be trdnslerred Vld Yahoo Narchwe

Currently. Narthwe tratfrt: l‘b collected and forwarded to NSA lor rnernorralrzatbon In ant.I quantity only from 05-2003. On any green
day, Northwe traffic represents 25".".- [15681050320053 dolly PINWALE content allomtron 16063 currently]. 05-2003 Is scheduled
to be upgraded In the summer of 2013, It Is lrlrtel',I that memonalued Nartfiwe traffic, If still present m the t-nwronrnent, wlll grow
proportionally (Le double now. to 30 Gﬁfdae:

Narthwe tra'lfrr r, rnarlborr formatted emdrl, rneamnﬁ unlrke Yahoo webmarl, any atturhments present would be tollected as part of
the message Thrs I5 .1 dearnct advantage However, I! has not been determmed what causes an Narrhrue transfer of an account, so

these messages are ran-It; tolfr-ttr-(l ‘lnrr-"

 

 

BLUF (p. 2)

From Feb 98 2013' Propmetfr’rmmment latest DCJNqurm- reduttlon' Narthwe

BE U§ [tr-quested S? ronturrenre at S? NC on 5‘5 Feta with partral throttlrng of content from Yahoo, Narc hwe emarl traffr: whnch
contams data older than 6 months from MUSCULAR. Numerous 52 analysts have complement of its errstence. and the relatwefy
small mtr-Ilrgente value rt mntams does not Justify the armor volume of collettron at MUSCUtAR {Udth of the total darlv coltert]
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Bathground Smce July of .7012, Yahoo has been transferrmg entire email amounts usmg the Narthwe data format [a proprietary,-
format for whr-zh NSA had to ties-eloptustom demuftrplexers]. to date, we are unsure why these accounts are helng transferred --
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CurrL'rl'll',', Natchlvu tralhc l5 (our:ch and fulwaldL-d to NSA l0! mcrnurlalrmlmrl In dl'l‘; quanilw Only from DS-EC‘UB On ‘In'f' HIVL'I'I
clay. Narchmc :mlflc represents 25":- 1156810! DS-2OGB‘sdmly PINWALE content allocallcln IIBOGB currently} 05-2003 Is scheduled
to bu upﬁlndvd In {hr wmmrl of 2013. It I‘, ilinu-I‘,I that momurmlmm! Nauhwn: lmfhc, 1f mli pruwn‘l II"| 1hr cnvuonrm-nt. wlll glow
plopcmonaily (LI: double now. to 30 GBIdav}
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SSD Optlmuallnn bE'lli‘VI"; that Whlli‘ '2th Is "mlld' collecllon of content. the mom volume and '[hl- .‘Igt' — caupIE-d wllh thr-
llr1;)l(-<1K.1.5I]Il'-mlturl‘nfN.lr(hIw'-;Illlvnw — [11.15.05{Gill‘ﬂlngﬂlljl‘r :i.‘sl.‘l .1 II'--rl (It-Merll‘ uw Uf valuuhh- n".()llf(l"'. 59‘5-3 ()l NJrl'hm-
small tailvcléd was orlgnnalll.I sent and recs-wed more than 130 day“. after (OHPCIIOH. lhls regresems about 8 9 C18 J day of "loss
:llmrablv” colltmmn — long term allocal-on thal (Ould bl" malty hllmi «until more tnrnf‘lv‘ [HE-ful fl hom [hl'i lu([.'ill\'t" 550 5111'- Ax
always wllh cur opllmlzatlun, the dam would ill“ be .wallable at [he sale store for SlGDEV. This would not Impact meladata
Pulmclron.

 

 

 

 

